CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

What is CVE-2024-45387?

CVE-2024-45387 is a critical vulnerability in Apache Traffic Control, published on 23 Dec 2024.

Official description

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request.

Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.

Weakness: CWE-89, CWE-285

Which versions are affected by CVE-2024-45387?

4 open source packages ship an affected version, including github.com/apache/trafficcontrol/v8 and github.com/apache/trafficcontrol. It affects 1 product.

Products include Apache Traffic Control.

How do I fix CVE-2024-45387?

Upgrade github.com/apache/trafficcontrol/v8 to 8.0.2 or later.

Is CVE-2024-45387 being exploited?

There is no known exploitation of CVE-2024-45387 in the wild and no public exploit code.

Other vulnerabilities in Apache Traffic Control

• CVE-2021-43350 LDAP filter injection vulnerability in Traffic Ops Critical 9.8
• CVE-2019-12405 Improper Authentication in Apache Traffic Control Critical 9.8
• CVE-2025-61581 Apache Traffic Control: ReDoS issue in Traffic Router configuration High 7.5
• CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth High 7.5
• CVE-2017-7670 Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vq94-9pfv-ccqr, GO-2024-3358.